Sentinel

Autonomous Security & Code Review Agent — review your pull requests, catch bugs and security issues, and (optionally) fix them automatically. 100% free and local-first.

License: MIT · Roadmap/design: BRD.md

Why Sentinel?

Sentinel combines three things no single tool offers for free:

1. Static analyzer evidence (Bandit, Ruff, custom rules) — hard facts, zero hallucinations.

2. Local LLM explanation (Ollama default) — why it's dangerous, how it could be exploited.

3. Validated auto-fix — a patch that passes syntax checks, analyzer re-runs, and your tests before it's proposed.

It also ships open, AI-verified rule books (sentinel/rules/books/*.yml): every rule credits its author and becomes ai_verified only after an empirical match-test and an independent AI cross-review — the seed of a community rule marketplace.

Related MCP server: code-review-mcp-server

Quick start

# Install
pip install sentinel-code-agent            # (coming soon to PyPI)
# or from source:
git clone https://github.com/Magudapa/sentinel && cd sentinel && pip install -e ".[dev]"

# 1. Pull a local model (free, offline-capable)
ollama pull qwen2.5-coder:7b

# 2. Review a pull request
sentinel review --provider github --repo owner/repo --pr 42

# 3. Review a local diff (no network at all)
git diff HEAD~1 | sentinel review --diff -

Output: human Markdown, JSON, and standard SARIF (works with GitHub code scanning).

Features

• ✅ Review PRs from GitHub / GitLab / Bitbucket or raw diffs and local repos

• ✅ Security scan: secrets, SQL, command injection, unsafe eval/pickle, weak crypto

• ✅ Bug & style scan: Ruff (Python), plus custom repo rules ( .sentinel.yml)

• ✅ Plain-English explanations from your local model (Ollama) or any OpenAI-compatible API

• ✅ Severity-ranked verdict with a 0–100 score

• ✅ Auto-fix: generates validated patches and opens a PR (human always approves)

• ✅ Codebase memory: Chroma vector store reminds you where you fixed the same thing before

• ✅ MCP server — Claude, Langflow, or any MCP client can call review_pr / review_diff

• ✅ REST API — sentinel serve exposes /api/v1/health, /api/v1/review, /api/v1/rulesets (FastAPI, localhost-first)

• ✅ AI-verified rule books — open, authored, two-gate (empirical + independent AI) rule system, sentinel ruleset list|verify|generate

• ✅ SARIF export for GitHub code scanning integration

Architecture

Providers (GitHub/GitLab/Bitbucket/Local)
        │  diff
        ▼
Analyzers (Bandit/Ruff/Custom) ── evidence
        │                         │
        ▼                         ▼
   Reviewer Pipeline  ──►  Model Layer (Ollama default)
   classify → explain             │
        │                         │
        ▼                         ▼
   Findings ──► CLI / JSON / SARIF / MCP ◄── Chroma memory (fixed-before)
        │
        ▼
   Auto-fix loop: patch → validate → tests → open PR

Design decisions and full backlog are in BRD.md. This project's architecture was informed by studying 20+ leading open-source AI repos (OpenHands, MCP SDK/Servers, Ollama, LiteLLM, Qdrant/Chroma, LangGraph and friends) — see ARCHITECTURE.md.

Development

pip install -e ".[dev]"
pytest            # run tests
ruff check .      # lint

Roadmap

Status of the BRD → production milestones:

Contributing

Open issues/PRs. Ideas wanted: Bitbucket provider, Semgrep rules plugin, pip-audit dependency analysis, Chrome-extension-like IDE hints, webhook daemon (sentinel watch).